
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Control your AI agents from anywhere. Mobile-first tmux web client that lets you wrangle Claude Code, agentic workflows, and persistent terminal sessions from your phone.
Inspiration strikes unexpectedly—often when you're away from your desk. With tmux-mobile, your development environment travels with you. Access it locally or over a secure Cloudflare tunnel.
Why tmux + mobile matters now:


Node.js 20 or newer is required.tmux must be installed on the machine running tmux-mobile.brew install tmux
echo 'set -g mouse on' >> ~/.tmux.conf
tmux source-file ~/.tmux.conf
npx tmux-mobile
The CLI prints:
Local URL: ...?token=...Tunnel URL: ...?token=... (when tunnel is enabled)Password: ... (when password auth is enabled)Open either URL directly on your phone.
npm install
npm start
--password, a random password is generated.--no-require-password.0.0.x while the interface and operational behavior are still being refined.tmux-mobile [options]
Options:
-p, --port <port> Local port (default: 8767)
--password <pass> Authentication password (optional; auto-generated by default)
--[no-]require-password Toggle password requirement (default: true)
--no-tunnel Don't start cloudflared tunnel
--session <name> Default tmux session name (default: main)
--scrollback <lines> Default scrollback capture lines (default: 1000)
--debug-log <path> Write backend debug logs to a file
Optional environment variables:
TMUX_MOBILE_SOCKET_NAME: use a dedicated tmux socket name (tmux -L) for isolationTMUX_MOBILE_SOCKET_PATH: use an explicit tmux socket path (tmux -S)TMUX_MOBILE_DEBUG_LOG: alternative way to enable debug log file outputTMUX_MOBILE_FORCE_SCRIPT_PTY=1: force the Unix script(1) PTY fallbacknpm run dev
Quality gate:
npm run typecheck
npm test
npm run test:e2e
npm run build
The automated harness avoids manual QA by validating the tmux protocol flow end-to-end:
FakeTmuxGateway: in-memory tmux session/window/pane state machineFakePtyFactory: captures terminal writes/resizes and emits PTY outputnpm run test:smoke
FAQs
Terminal tunnel server for PocketCmd - secure remote tmux access
We found that pocketcmd demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.